EUVD-2026-85507

Unauthenticated Broken Access Control in Loops & Logic = 4.2.4 versions...

CVE-2026-95604

The Loops & Logic WordPress plugin is vulnerable to an unauthenticated Broken Access Control flaw in versions

CVE-2026-95602

The YITH WooCommerce Request A Quote WordPress plugin is vulnerable to an Insecure Direct Object Reference (IDOR) flaw in versions prior to 4.46.1 . The root cause is an Authorization Bypass where incorrectly configured access control security levels allow for exploitation via user-controlled key...

EUVD-2026-85495

Unauthenticated Broken Access Control in Conekta Payment Gateway = 6.2.4 versions...

CVE-2026-95527

The Conekta Payment Gateway WordPress plugin, versions

CVE-2026-95513

The Online Booking & Scheduling Calendar for WordPress by vcita plugin, affecting versions

EUVD-2026-85488

Unauthenticated Broken Access Control in Online Booking & Scheduling Calendar for WordPress by vcita = 4.6.0 versions...

CVE-2026-94679

The Fluent Support WordPress plugin, version 2.3.2 and below , is affected by a Broken Access Control vulnerability. This flaw allows for unauthorized actions within the subscriber context. No specific technical root cause, practical consequences, or remediation steps are provided in the availabl...

EUVD-2026-85484

Subscriber Broken Access Control in Fluent Support = 2.3.2 versions...

EUVD-2026-85481

Unauthenticated Broken Access Control in AppMySite = 3.15.4 versions...

CVE-2026-94498

The AppMySite WordPress plugin (versions

CVE-2026-94080

Versions of the MarketKing WordPress plugin up to and including 2.1.70 are susceptible to an unauthenticated broken access control vulnerability. The vulnerability allows an attacker to perform actions without proper authorization. No specific root cause, practical impact details, or remediation ...

EUVD-2026-85470

Unauthenticated Broken Access Control in MarketKing = 2.1.70 versions...

CVE-2026-94079

The WP User Manager plugin for WordPress, affecting versions

EUVD-2026-85469

Unauthenticated Broken Access Control in WP User Manager = 2.9.19 versions...

CVE-2026-93620

The PayPlus Payment Gateway WordPress plugin, in versions

EUVD-2026-85463

Unauthenticated Broken Access Control in PayPlus Payment Gateway = 8.2.5 versions...

EUVD-2026-85461

Contributor Broken Access Control in WSP MCP AI Agents Connector = 2.7.0 versions...

CVE-2026-93529

The WSP MCP – AI Agents Connector plugin for WordPress versions ≤ 2.7.0 is affected by a Broken Access Control vulnerability. The vulnerability specifically affects contributors , which may allow for unauthorized actions or data modification due to improper permission enforcement. No specific roo...

SUSE CVE-2026-93565

A flaw was found in Netty RtspDecoder. The RtspMethods.valueOf function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol RTSP requests. A remote attacker can exploit this by sending a specially crafted RTSP request, leading to method-token smuggling. Th...